skills/volcengine/openviking/weather/Gen Agent Trust Hub

weather

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes curl to perform network requests and save image data to the /tmp directory. These operations are consistent with the skill's primary purpose of retrieving weather forecasts.
  • [EXTERNAL_DOWNLOADS]: The skill fetches data from wttr.in and open-meteo.com. These are well-known, established public services frequently used for programmatic weather data access.
  • [INDIRECT_PROMPT_INJECTION]: The skill displays data fetched from external web services, representing a standard attack surface for indirect prompt injection.
  • Ingestion points: External content fetched from wttr.in and api.open-meteo.com (SKILL.md).
  • Boundary markers: None provided to separate API output from agent instructions.
  • Capability inventory: Network access via curl and file writing capability to /tmp (SKILL.md).
  • Sanitization: Instructions mention basic URL-encoding for input parameters (e.g., city names).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 06:32 AM
Security Audit — agent-trust-hub — weather